In IT systems, a technical means for controlling access to computing or information resources must be provided for security purposes. A resource could represent data such as a file or database, network elements such as routers and switches, or computer systems. Access is the ability to manipulate, for example, view, add, modify, or delete, a resource. Access control is the means by which the ability to access is explicitly enabled or restricted in some way through system administration. Access controls can prescribe not only who or what process or entity may have access to a specific system resource, but also the type of access that is permitted.
The traditional Role-Based Access Control (RBAC) is a powerful technique developed for controlling access to resources in a complex system. With role-based access control access rights are grouped by role name, and the use of resources is restricted to users authorized to assume the associated role. For example, within an IT system the role of system administrator can include operations to perform resource viewing, addition, modification, deletion while the role of librarian can only include operations to view system resources. The advantage of having roles with associated groups of subjects is that by changing the permissions of a single role, the access rights of all the subjects in the group are changed.
However, there are drawbacks with the traditional RBAC system, especially in large distributed systems because subjects with the same role always have the same set of permissions against the same set of resources.
Subjects having the same role cannot be assigned access to different resources. Therefore, a subject belonging to a first organization having the same roles and permissions as a subject belonging to a second organization may have access to resources of the second organization. Additionally, there is no mechanism to distinguish a role across organizations in a large scale system where multiple organizations may be operating concurrently. To simplify the management of a large scale modern IT system, it is desirable to have a role that can have different meanings from organization to organization. For example, in a grid computing environment, the access rights of a role, such as librarian, may vary from organization to organization, and the role may have a different set of permissions in each organization, more specifically, organizations can independently assign permissions to roles according to local policies.